
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Head to https://www.originprotocol.com/developers to learn more about what we're building and how to get involved.
origin-js is a library of javascript code and Ethereum smart contracts which allow anyone to create decentralized marketplaces, including for fractional usage. It is an open source project created by Origin Protocol.
⚠️ This is an alpha version which is not suitable for production environments.
origin-js is showcased in our Demo DApp currently running on the Rinkeby testnet.
npm install origin --save
or
yarn add origin
A browser-compatible plain javascript file origin.js
is available in the Releases section. A hosted version can be directly included in your html as:
<script src="https://code.originprotocol.com/origin-js/origin-v0.7.1.js"></script>
npm build
will generate this file and save it to dist/origin.js
.
We recommend using Origin Box for development and testing on your local machine. This saves you the headache of spinning up several environments and running multiple, different processes.
git clone https://github.com/OriginProtocol/origin-js.git && cd origin-js
Install dependencies and link by running npm run install:dev
. This script is a shortcut for npm install && npm link
. Linking means that changes to origin-js
code are immediately available to local DApps without an npm install
.
Start the local blockchain and build origin-js by running npm start
. Code changes will trigger a live rebuild.
To interact with your local origin-js and local blockahin, see the instructions in our Demo DApp.
Our full test suite can be run with:
npm run test
Note: you should not have the server running at this time, as these tests start their own local blockchain instance.
To run non-contract tests (test/**.js
):
npm run test:js
To run non-contract tests and automatically re-run when files change:
npm run test:jsw
Our Solidity tests (which use Truffle) are located at contracts/test
.
npm run test:contracts
Note: you should not have the server running at this time, as these tests start their own local blockchain instance.
To run contract tests and automatically re-run when files change:
npm run test:contractsw
To run contract tests and measure test coverage of Solidity code:
npm run test:contracts-coverage
A subset of our tests can be run from the browser. These tests are automatically served at http://localhost:8081
when you run npm start
. These tests are automatically rerun when source or test code is changed.
Run a subset of these tests using the grep
query string parameter, for example: http://localhost:8081/?grep=IpfsService
By default, starting origin-js locally starts ganache-cli automatically. However, for development you might want to connect to the GUI version of Ganache. This provides a nice interface for browsing your local blockchain activity and can be useful for debugging.
To use the Ganache GUI:
Port Number
to 8545
Network ID
to 999
Accounts & Keys
tab, set the mnemonic to candy maple cake sugar pudding cream honey rich smooth crumble sweet treat
npm run start:no-ganache
(instead of npm run start
)If you have Python 3 installed, you may see this error when installing dependencies:
gyp ERR! stack Error: Python executable "/Users/aiham/.pyenv/shims/python" is v3.6.4, which is not supported by gyp.
Resolve this by configuring npm to use Python 2 (where python2.7 is a binary accessible from your $PATH):
npm config set python python2.7
Origin is an 100% open-source and community-driven project and we welcome contributions of all sorts. There are many ways to help, from reporting issues, contributing code, and helping us improve our community.
To get involved, please join our Discord channel and review our guide to contributing.
FAQs

We found that origin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.